From cdd1ce2ad4ab5851de949f13ba085b306b8e70b2 Mon Sep 17 00:00:00 2001 From: pku-xht Date: Wed, 8 Jul 2026 15:31:14 +0800 Subject: [PATCH 1/8] feat(subagent): extract dsh-subagent-process shared out-of-process machinery MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The credential env scrub (SENSITIVE_ENV_PATTERN/buildChildEnv), the spawn-failure capture (spawnFailure), the child-exit waits (waitForExit/exitsWithin), and the stdin-EOF -> SIGTERM -> SIGKILL dispose ladder move out of subagent-acp into a new pure library package (the subagent-inprocess shape), with the ladder taking its two grace periods as parameters — defaults stay in the plugin Config. New isolated-config-dir helpers (mkdtemp create, best-effort remove; a pinned dir is never removed) land alongside for the CLAUDE_CONFIG_DIR / CODEX_HOME redirection the RFC names. The ACP backend migrates onto the library with no semantic change: its suite passes with import-path edits only. bash-local keeps its sibling copy, per the RFC's blast-radius call. RFC: docs/rfc/proposed/feature/2026-07-07-claude-code-and-codex-subagent-backends.md --- docs/config-catalog.md | 1 + docs/module-graph.md | 5 +- knip.json | 5 + packages/subagent/README.md | 3 +- packages/subagent/subagent-acp/package.json | 2 + packages/subagent/subagent-acp/src/run.ts | 98 ++---- .../subagent-acp/tests/subagent-acp.spec.ts | 3 +- packages/subagent/subagent-acp/tsconfig.json | 3 + packages/subagent/subagent-process/README.md | 40 +++ .../subagent/subagent-process/package.json | 30 ++ .../subagent/subagent-process/src/index.ts | 207 ++++++++++++ .../tests/subagent-process.spec.ts | 307 ++++++++++++++++++ .../subagent/subagent-process/tsconfig.json | 11 + pnpm-lock.yaml | 9 + tsconfig.build.json | 1 + tsconfig.json | 1 + 16 files changed, 645 insertions(+), 81 deletions(-) create mode 100644 packages/subagent/subagent-process/README.md create mode 100644 packages/subagent/subagent-process/package.json create mode 100644 packages/subagent/subagent-process/src/index.ts create mode 100644 packages/subagent/subagent-process/tests/subagent-process.spec.ts create mode 100644 packages/subagent/subagent-process/tsconfig.json diff --git a/docs/config-catalog.md b/docs/config-catalog.md index e55066101f..c01d42f87d 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -816,3 +816,4 @@ Imported as libraries by other packages; a `cordis.yml` cannot load them. - `@deepseek-ai/dsh-brand` ([`packages/util/brand/src/index.ts`](../packages/util/brand/src/index.ts)) - `@deepseek-ai/dsh-hook-protocol` ([`packages/hooks/hook-protocol/src/index.ts`](../packages/hooks/hook-protocol/src/index.ts)) - `@deepseek-ai/dsh-subagent-inprocess` ([`packages/subagent/subagent-inprocess/src/index.ts`](../packages/subagent/subagent-inprocess/src/index.ts)) +- `@deepseek-ai/dsh-subagent-process` ([`packages/subagent/subagent-process/src/index.ts`](../packages/subagent/subagent-process/src/index.ts)) diff --git a/docs/module-graph.md b/docs/module-graph.md index 5e043d22d4..cadf8d0d14 100644 --- a/docs/module-graph.md +++ b/docs/module-graph.md @@ -43,6 +43,7 @@ flowchart TD pkg_subagent_acp["subagent-acp"] pkg_subagent_fork["subagent-fork"] pkg_subagent_inprocess["subagent-inprocess"] + pkg_subagent_process["subagent-process"] pkg_subagent_spawn["subagent-spawn"] pkg_tool_subagent["tool-subagent"] end @@ -171,6 +172,7 @@ flowchart TD pkg_subagent_acp --> pkg_agent pkg_subagent_acp --> pkg_llm pkg_subagent_acp --> pkg_subagent + pkg_subagent_acp --> pkg_subagent_process pkg_subagent_inprocess --> pkg_agent pkg_subagent_inprocess --> pkg_llm pkg_subagent_inprocess --> pkg_session @@ -211,6 +213,7 @@ flowchart TD | Package | Group | Depends on | | --- | --- | --- | | [`brand`](../packages/util/brand) | `util` | — | +| [`subagent-process`](../packages/subagent/subagent-process) | `subagent` | — | | [`acp-snapshot`](../packages/support/acp-snapshot) | `support` | — | | [`app-boot`](../packages/ui/app-boot) | `ui` | — | | [`code-runtime`](../packages/code-runtime/code-runtime) | `code-runtime` | — | @@ -248,7 +251,7 @@ flowchart TD | [`hooks-codex`](../packages/hooks/hooks-codex) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`tools`](../packages/core/tools) | | [`acp`](../packages/ui/acp) | `ui` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`tools`](../packages/core/tools) | | [`agent-core`](../packages/core/agent-core) | `core` | [`agent`](../packages/core/agent), [`agent-loop`](../packages/core/agent-loop), [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`tool-bash`](../packages/bash/tool-bash), [`tools`](../packages/core/tools) | -| [`subagent-acp`](../packages/subagent/subagent-acp) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent) | +| [`subagent-acp`](../packages/subagent/subagent-acp) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`subagent-process`](../packages/subagent/subagent-process) | | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) | | [`tool-subagent`](../packages/subagent/tool-subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) | | [`hooks-claude`](../packages/hooks/hooks-claude) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) | diff --git a/knip.json b/knip.json index 8c0f71f3af..1ab6d39a9e 100644 --- a/knip.json +++ b/knip.json @@ -66,6 +66,11 @@ "entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts", "tests/mock-acp-server.ts"], "project": ["src/**/*.ts", "tests/**/*.ts"] }, + "packages/subagent/subagent-process": { + "entry": ["tests/**/*.spec.ts"], + "project": ["src/**/*.ts", "tests/**/*.ts"], + "ignoreDependencies": ["cordis"] + }, "packages/fs/tool-fs": { "entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"], "project": ["src/**/*.ts", "tests/**/*.ts"] diff --git a/packages/subagent/README.md b/packages/subagent/README.md index 6da8ee42f5..38c64d22a5 100644 --- a/packages/subagent/README.md +++ b/packages/subagent/README.md @@ -8,9 +8,10 @@ The subagent seam: an agent delegating work to a child agent. Like the [bash](.. | `subagent-inprocess/` | Shared in-process run driver (pure lib; registers nothing) | — | | `subagent-spawn/` | In-process backend: a fresh child agent | (registers on `ctx.subagents`) | | `subagent-fork/` | In-process backend: a child seeded with the parent's completed-turn prefix | (registers on `ctx.subagents`) | +| `subagent-process/` | Shared out-of-process machinery: env scrub, dispose ladder, isolated config dirs (pure lib; registers nothing) | — | | `subagent-acp/` | Out-of-process backend: a child agent in a spawned subprocess, driven over ACP | (registers on `ctx.subagents`) | | `tool-subagent/` | Model-facing `subagent` delegation tool over `ctx.subagents` | (registers on `ctx.tools`) | -The interface lives at `subagent/subagent/`. The in-process `subagent-spawn` / `subagent-fork` backends share the `subagent-inprocess` driver (a pure library — both depend on it, neither on the other), and the out-of-process `subagent-acp` backend ships alongside them here; the test-only `dsh-subagent-mock` (in [support](../support/README.md)) is separate. All **product** packages except the mock. +The interface lives at `subagent/subagent/`. The in-process `subagent-spawn` / `subagent-fork` backends share the `subagent-inprocess` driver (a pure library — both depend on it, neither on the other), the out-of-process `subagent-acp` backend builds on the `subagent-process` library (the credential env scrub, the dispose ladder, isolated config dirs) and ships alongside them here; the test-only `dsh-subagent-mock` (in [support](../support/README.md)) is separate. All **product** packages except the mock. The proposal and design rationale: [docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md](../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md). diff --git a/packages/subagent/subagent-acp/package.json b/packages/subagent/subagent-acp/package.json index 2c55051da9..45fc6b072c 100644 --- a/packages/subagent/subagent-acp/package.json +++ b/packages/subagent/subagent-acp/package.json @@ -25,6 +25,7 @@ "@deepseek-ai/dsh-agent": "^0.0.1", "@deepseek-ai/dsh-llm": "^0.0.1", "@deepseek-ai/dsh-subagent": "^0.0.1", + "@deepseek-ai/dsh-subagent-process": "^0.0.1", "cordis": "^4.0.0-rc.6" }, "dependencies": { @@ -35,6 +36,7 @@ "@deepseek-ai/dsh-agent": "workspace:^", "@deepseek-ai/dsh-llm": "workspace:^", "@deepseek-ai/dsh-subagent": "workspace:^", + "@deepseek-ai/dsh-subagent-process": "workspace:^", "@cordisjs/plugin-loader": "^1.0.0-rc.4", "cordis": "^4.0.0-rc.6" } diff --git a/packages/subagent/subagent-acp/src/run.ts b/packages/subagent/subagent-acp/src/run.ts index d7631f4d8d..a94c923f46 100644 --- a/packages/subagent/subagent-acp/src/run.ts +++ b/packages/subagent/subagent-acp/src/run.ts @@ -22,7 +22,7 @@ * @module @deepseek-ai/dsh-subagent-acp/run */ -import { spawn, type ChildProcess } from 'node:child_process' +import { spawn } from 'node:child_process' import { randomUUID } from 'node:crypto' import { Readable, Writable } from 'node:stream' import { @@ -40,6 +40,7 @@ import { import { AgentId } from '@deepseek-ai/dsh-agent' import type { ContentBlock } from '@deepseek-ai/dsh-llm' import type { SubagentResult, SubagentRun, SubagentStartRequest, SubagentStopReason } from '@deepseek-ai/dsh-subagent' +import { buildChildEnv, disposeChildProcess, spawnFailure } from '@deepseek-ai/dsh-subagent-process' /** * How the client answers a child's `session/request_permission`. The first cut @@ -110,31 +111,6 @@ export const DEFAULT_DISPOSE_EOF_GRACE_MS = 6_000 /** Default grace between SIGTERM and SIGKILL on dispose (the `disposeGraceMs` config; mirrors the bash executor). */ export const DEFAULT_DISPOSE_GRACE_MS = 3_000 -/** - * Credential-shaped ambient env vars are NOT forwarded to the child by default - * (the parent harness's own `DEEPSEEK_API_KEY`/secrets must not leak into a - * spawned process implicitly). Same pattern as the bash executor. The child - * agent needs its OWN credentials to reach a model — those are supplied - * explicitly via {@link AcpRunSpec.env}, which is layered on top AFTER the - * scrub, so an intended `DEEPSEEK_API_KEY` survives while an incidental - * `AWS_SECRET_ACCESS_KEY` does not. - */ -export const SENSITIVE_ENV_PATTERN = /KEY|SECRET|TOKEN/i - -/** - * The ambient env minus credential-shaped vars, plus the spec's explicit env. - * @param extra - explicit vars layered on top AFTER the scrub, so a - * credential-shaped name supplied deliberately still reaches the child. - * @returns the environment to spawn the child with. - */ -export function buildChildEnv(extra: Record): NodeJS.ProcessEnv { - const env: NodeJS.ProcessEnv = {} - for (const [key, value] of Object.entries(process.env)) { - if (!SENSITIVE_ENV_PATTERN.test(key)) env[key] = value - } - return { ...env, ...extra } -} - /** * Map an ACP {@link StopReason} to a harness {@link SubagentStopReason}. * @param reason - the terminal reason from the child's `session/prompt` response. @@ -196,24 +172,6 @@ function toError(value: unknown): Error { return value instanceof Error ? value : new Error(String(value)) } -/** Resolve once the child process exits (any code/signal); immediate if gone. */ -function waitForExit(child: ChildProcess): Promise { - // Already-exited fast path: dispose guards on exitCode before calling, so in - // tests the child is always still alive here. - /* v8 ignore next */ - if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve() - return new Promise(resolve => child.once('exit', () => { resolve() })) -} - -/** Resolve `true` if the child exits within `ms`, `false` on timeout. */ -function exitsWithin(child: ChildProcess, ms: number): Promise { - return Promise.race([ - waitForExit(child).then(() => true), - // `.unref()` so a pending grace timer never keeps the parent's loop alive. - new Promise(resolve => setTimeout(() => { resolve(false) }, ms).unref()), - ]) -} - /** * Start an out-of-process ACP child for `request` and return a {@link SubagentRun}. * @@ -254,13 +212,11 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su env: buildChildEnv(spec.env), stdio: ['pipe', 'pipe', 'inherit'], }) - // A spawn-level failure (e.g. ENOENT for a bad command) is emitted as an - // `error` event, NOT a thrown exception — without a listener Node treats it as - // an unhandled error and crashes the parent. Capture it into a promise the - // result path races, so a bad command settles `error` like any child failure. - const spawnFailed = new Promise((resolve) => { - child.once('error', (err) => { resolve(err) }) - }) + // Same-tick capture (the library's contract): a spawn-level failure (e.g. + // ENOENT for a bad command) is an `error` EVENT that would crash the parent + // unheard; the result path races this promise, so a bad command settles + // `error` like any child failure. + const spawnFailed = spawnFailure(child) // Accumulate the child's streamed assistant text — the SubagentResult output. const output: string[] = [] @@ -393,33 +349,19 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su }, async dispose(): Promise { request.signal?.removeEventListener('abort', onAbort) - // Reach quiescence, not merely request it (dispose must AWAIT the child - // actually stopping). If the child is already gone, nothing to do. - if (child.exitCode !== null || child.signalCode !== null) return - const eofGraceMs = spec.disposeEofGraceMs - const graceMs = spec.disposeGraceMs - // 1. Graceful: end the ACP request stream (stdin EOF) and let the child - // quiesce ON ITS OWN. Our acp-agent has NO SIGTERM handler in a normal - // session — it tears down via the server bridge's connection-close path - // (conn.closed → per-agent dispose → final session/flush), driven by the - // stdin EOF, NOT by a signal. A prompt response can resolve from a - // turn/end BEFORE that post-turn flush lands, so the child still has - // durable work owed when dispose runs. Give the EOF-driven quiesce a real - // window — wider than a single signal-grace, since the child's own - // teardown may itself be awaiting a signal-trapping grandchild (a bash - // subprocess in its own SIGTERM→SIGKILL grace) plus a flush — and only - // escalate if it overruns. Sending SIGTERM in the same tick (or too soon) - // would default-terminate the child mid-flush, orphaning its nested work. - child.stdin.end() - if (await exitsWithin(child, eofGraceMs)) return - // 2. SIGTERM, then escalate to SIGKILL if it still does not exit within the - // grace period — a child that ignores EOF and traps SIGTERM must not - // wedge dispose forever (the seam requires bounded quiescence). - child.kill('SIGTERM') - if (await exitsWithin(child, graceMs)) return - // 3. Force-kill and await the (now-certain) exit. - child.kill('SIGKILL') - await waitForExit(child) + // Quiescent teardown via the shared ladder (stdin EOF → SIGTERM → + // SIGKILL, awaiting the actual exit). For THIS child the EOF tier is the + // one that matters: our acp-agent has NO SIGTERM handler in a normal + // session — it tears down via the server bridge's connection-close path + // (conn.closed → per-agent dispose → final session/flush), driven by the + // stdin EOF, NOT by a signal — and a prompt response can resolve from a + // turn/end BEFORE that post-turn flush lands, so the child still has + // durable work owed when dispose runs (hence the wide EOF grace; see + // DEFAULT_DISPOSE_EOF_GRACE_MS). + await disposeChildProcess(child, { + disposeEofGraceMs: spec.disposeEofGraceMs, + disposeGraceMs: spec.disposeGraceMs, + }) }, } } diff --git a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts index 3eb12fac38..6d351c71d0 100644 --- a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts +++ b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts @@ -6,9 +6,10 @@ import { tmpdir } from 'node:os' import { join } from 'node:path' import { fileURLToPath } from 'node:url' import SubagentService from '@deepseek-ai/dsh-subagent' +import { buildChildEnv, SENSITIVE_ENV_PATTERN } from '@deepseek-ai/dsh-subagent-process' import type { Agent } from '@deepseek-ai/dsh-agent' import * as acp from '../src/index.ts' -import { acpStopReason, acpContentText, buildChildEnv, DEFAULT_DISPOSE_EOF_GRACE_MS, DEFAULT_DISPOSE_GRACE_MS, SENSITIVE_ENV_PATTERN, startAcpRun, toAcpPrompt, type AcpRunSpec } from '../src/run.ts' +import { acpStopReason, acpContentText, DEFAULT_DISPOSE_EOF_GRACE_MS, DEFAULT_DISPOSE_GRACE_MS, startAcpRun, toAcpPrompt, type AcpRunSpec } from '../src/run.ts' /** * Keyless integration tests for the ACP subagent backend. Each spawns a REAL diff --git a/packages/subagent/subagent-acp/tsconfig.json b/packages/subagent/subagent-acp/tsconfig.json index 3c06fef150..ab24f60f93 100644 --- a/packages/subagent/subagent-acp/tsconfig.json +++ b/packages/subagent/subagent-acp/tsconfig.json @@ -25,6 +25,9 @@ }, { "path": "../subagent" + }, + { + "path": "../subagent-process" } ] } diff --git a/packages/subagent/subagent-process/README.md b/packages/subagent/subagent-process/README.md new file mode 100644 index 0000000000..597470f52a --- /dev/null +++ b/packages/subagent/subagent-process/README.md @@ -0,0 +1,40 @@ +# @deepseek-ai/dsh-subagent-process + +Shared machinery for **out-of-process subagent backends** — providers that spawn an external agent as a child process, such as the [ACP backend](../subagent-acp/README.md). A pure library (no provider, no registration, no Config): what every spawn-a-CLI-child backend needs to keep the parent deployment's credentials out of the child, tear the child down to quiescence, and isolate it from the host user's on-disk CLI state. Design rationale: [the Claude Code / Codex subagent backends RFC](../../../docs/rfc/proposed/feature/2026-07-07-claude-code-and-codex-subagent-backends.md). + +Every tunable is a **parameter**: the dispose ladder takes its grace periods per call, the config-dir helper takes an optional pinned path. Defaults live in each consuming plugin's Config (defaulted, validated fields changeable from `cordis.yml`), never in this library. + +## What it exports + +### `SENSITIVE_ENV_PATTERN` / `buildChildEnv(extra)` + +The credential env scrub (same pattern as the [bash executor](../../bash/bash-local/README.md)): the child env is the ambient env minus credential-shaped vars (`/KEY|SECRET|TOKEN/i`), with `extra` layered on top AFTER the scrub. `PATH`, `HOME`, `TMPDIR`, locale, and proxy vars survive, so the child CLI runs normally; the parent's own secrets never leak implicitly, while an explicitly supplied credential (the child's OWN key in a backend's `env` config) still reaches the child. + +### `spawnFailure(child)` + +Spawn-failure capture: a promise that resolves (never rejects) with the child's first `error` event. A spawn failure such as `ENOENT` is an event, not a thrown exception — without a listener Node crashes the parent process — so call this in the same tick as `spawn()` and race it in the run's result path; a bad command then settles as an ordinary child-level failure. For a child that spawns cleanly the promise never settles. + +### `waitForExit(child)` / `exitsWithin(child, ms)` + +Exit waits over a `ChildProcess`: resolve once the child exits by any code or signal (immediately if it is already gone), or race that against a timer (`true` = exited in time; the pending timer is `unref()`ed so a grace window never keeps the parent's event loop alive). + +### `disposeChildProcess(child, graces)` + +The three-tier dispose ladder. Resolves only once the child has ACTUALLY exited — quiescence reached, not merely requested (see [defensive patterns](../../../docs/defensive-patterns.md)): + +1. stdin EOF (when stdin is piped), then wait `graces.disposeEofGraceMs` — a cooperative child quiesces on its own, its flushes and nested-subprocess teardown intact; +2. `SIGTERM`, then wait `graces.disposeGraceMs`; +3. `SIGKILL`, then await the now-certain exit — a child that ignores EOF and traps `SIGTERM` cannot wedge dispose forever. + +The two graces (`DisposeLadderGraces`) come from the consuming plugin's `disposeEofGraceMs`/`disposeGraceMs` Config fields; the EOF window is deliberately a separate — usually wider — grace than the signal tier, since a cooperative child's EOF teardown may itself await a signal-trapping grandchild plus a final flush. + +### `createIsolatedConfigDir(prefix, pinnedPath?)` + +A per-run isolated config directory for an external CLI child (the target of `CLAUDE_CONFIG_DIR` / `CODEX_HOME`-style redirection), so child behavior is a function of deployment config alone — never of whatever `~/.claude` / `~/.codex`-style state exists on the host. Returns an `IsolatedConfigDir` handle: `path` goes into the child env, `remove()` runs on dispose. + +- **Fresh (default)**: a private (0700) `mkdtemp` dir under the OS temp root; `remove()` deletes it best-effort (never rejects — a leftover temp dir beats a failed dispose) and is idempotent. +- **Pinned** (`pinnedPath` set): the path is returned as-is — never created, never removed. A deployment that pins a directory to share child state across runs owns that directory's lifecycle. + +## Testing + +`tests/subagent-process.spec.ts`: the env scrub and config-dir helpers run against the real process env and real filesystem (including an rm-failure path proving `remove()` never rejects); the exit waits and the dispose ladder run against a scriptable fake child, driving each escalation tier deterministically. The [ACP backend suite](../subagent-acp/README.md) exercises the same ladder against real subprocesses (EOF-cooperative, EOF-ignoring, and SIGTERM-trapping children) end to end. diff --git a/packages/subagent/subagent-process/package.json b/packages/subagent/subagent-process/package.json new file mode 100644 index 0000000000..218276be44 --- /dev/null +++ b/packages/subagent/subagent-process/package.json @@ -0,0 +1,30 @@ +{ + "name": "@deepseek-ai/dsh-subagent-process", + "description": "Shared out-of-process subagent machinery: credential env scrub, spawn-failure capture, child-exit waits, the EOF-to-SIGTERM-to-SIGKILL dispose ladder, and isolated config dirs (pure lib; registers nothing)", + "version": "0.0.1", + "private": true, + "type": "module", + "main": "lib/index.js", + "types": "lib/types/index.d.ts", + "exports": { + ".": { + "types": "./lib/types/index.d.ts", + "default": "./lib/index.js" + }, + "./src/*": "./src/*", + "./package.json": "./package.json" + }, + "files": [ + "lib/index.js", + "lib/types/**/*.d.ts", + "lib/types/**/*.d.ts.map", + "src" + ], + "license": "BSD-3-Clause", + "peerDependencies": { + "cordis": "^4.0.0-rc.6" + }, + "devDependencies": { + "cordis": "^4.0.0-rc.6" + } +} diff --git a/packages/subagent/subagent-process/src/index.ts b/packages/subagent/subagent-process/src/index.ts new file mode 100644 index 0000000000..b54681d3c7 --- /dev/null +++ b/packages/subagent/subagent-process/src/index.ts @@ -0,0 +1,207 @@ +/** + * Shared machinery for OUT-OF-PROCESS subagent backends — providers that spawn + * an external agent as a child process and must keep the parent deployment's + * credentials out of it, tear it down to quiescence, and isolate it from the + * host user's on-disk CLI state. The pieces: the credential env scrub + * ({@link SENSITIVE_ENV_PATTERN} / {@link buildChildEnv}), the spawn-failure + * capture ({@link spawnFailure}), the child-exit waits ({@link waitForExit} / + * {@link exitsWithin}), the stdin-EOF → SIGTERM → SIGKILL dispose ladder + * ({@link disposeChildProcess}), and the per-run isolated config dir + * ({@link createIsolatedConfigDir}). + * + * This package owns no provider and registers nothing; it is a pure library + * the out-of-process backend packages depend on (the `subagent-inprocess` + * shape, for the process boundary). Every tunable — the ladder's grace + * periods, a pinned config dir — is a PARAMETER here: defaults belong in each + * consuming plugin's Config, per the no-hardcoded-tunables rule. + * + * @module @deepseek-ai/dsh-subagent-process + */ + +import type { ChildProcess } from 'node:child_process' +import { mkdtemp, rm } from 'node:fs/promises' +import { tmpdir } from 'node:os' +import { join } from 'node:path' + +/** + * Credential-shaped ambient env vars are NOT forwarded to a child by default + * (the parent harness's own `DEEPSEEK_API_KEY`/secrets must not leak into a + * spawned process implicitly). Same pattern as the bash executor. The child + * agent needs its OWN credentials to reach a model — those are supplied + * explicitly via the `extra` layer of {@link buildChildEnv}, which lands AFTER + * the scrub, so an intended `DEEPSEEK_API_KEY` survives while an incidental + * `AWS_SECRET_ACCESS_KEY` does not. + */ +export const SENSITIVE_ENV_PATTERN = /KEY|SECRET|TOKEN/i + +/** + * The ambient env minus credential-shaped vars, plus the caller's explicit + * env. `PATH`, `HOME`, `TMPDIR`, locale, and proxy vars survive the scrub, so + * a child CLI runs normally; only {@link SENSITIVE_ENV_PATTERN}-shaped names + * are dropped. + * @param extra - explicit vars layered on top AFTER the scrub, so a + * credential-shaped name supplied deliberately still reaches the child. + * @returns the environment to spawn the child with. + */ +export function buildChildEnv(extra: Record): NodeJS.ProcessEnv { + const env: NodeJS.ProcessEnv = {} + for (const [key, value] of Object.entries(process.env)) { + if (!SENSITIVE_ENV_PATTERN.test(key)) env[key] = value + } + return { ...env, ...extra } +} + +/** + * Capture the child's spawn-level failure as a promise the run's result path + * can race. A spawn failure (e.g. `ENOENT` for a bad command) is emitted as an + * `error` EVENT, not a thrown exception — and without a listener Node treats + * it as an unhandled error and crashes the parent process. Call this in the + * SAME TICK as `spawn()`, so no window exists for the event to fire unheard. + * @param child - the just-spawned child process. + * @returns a promise that RESOLVES (never rejects) with the child's first + * `error` event; for a child that spawns cleanly it never settles. + */ +export function spawnFailure(child: ChildProcess): Promise { + return new Promise((resolve) => { + child.once('error', (err) => { resolve(err) }) + }) +} + +/** + * Resolve once the child process exits (any code/signal); immediate if it is + * already gone. + * @param child - the child process to await. + */ +export function waitForExit(child: ChildProcess): Promise { + if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve() + return new Promise(resolve => child.once('exit', () => { resolve() })) +} + +/** + * Race the child's exit against a timer. + * @param child - the child process to watch. + * @param ms - the wait window in milliseconds. + * @returns `true` if the child exits within `ms`, `false` on timeout. + */ +export function exitsWithin(child: ChildProcess, ms: number): Promise { + return Promise.race([ + waitForExit(child).then(() => true), + // `.unref()` so a pending grace timer never keeps the parent's loop alive. + new Promise(resolve => setTimeout(() => { resolve(false) }, ms).unref()), + ]) +} + +/** + * The two grace periods of the dispose ladder, supplied per call by the + * consuming backend — each plugin carries them as defaulted, validated + * `disposeEofGraceMs`/`disposeGraceMs` Config fields, so teardown timing is + * deployment-tunable and this library hardcodes nothing. + */ +export interface DisposeLadderGraces { + /** + * Tier-1 window (ms): after stdin EOF, how long the child gets to quiesce + * ON ITS OWN — flush durable state, tear down its own nested subprocesses — + * before the parent escalates to `SIGTERM`. A separate (usually WIDER) + * grace than {@link DisposeLadderGraces.disposeGraceMs}: a cooperative + * child's EOF-driven teardown may itself be waiting on a signal-trapping + * grandchild plus a final flush, needing more than one signal-grace of + * headroom. + */ + disposeEofGraceMs: number + /** Tier-2 window (ms): between `SIGTERM` and the `SIGKILL` escalation. */ + disposeGraceMs: number +} + +/** + * Tear a child process down to QUIESCENCE: resolves only once the child has + * actually exited (or was already gone), never merely after requesting it. + * Three-tier escalation — + * + * 1. stdin EOF (when stdin is piped), then wait `disposeEofGraceMs`: a + * cooperative child quiesces on its own, its teardown and flushes intact; + * 2. `SIGTERM`, then wait `disposeGraceMs`; + * 3. `SIGKILL`, then await the (now-certain) exit — a child that ignores EOF + * and traps `SIGTERM` must not wedge dispose forever. + * + * @param child - the child process to tear down. + * @param graces - the two grace periods, from the consuming plugin's Config. + */ +export async function disposeChildProcess(child: ChildProcess, graces: DisposeLadderGraces): Promise { + // Already gone: nothing to reap. + if (child.exitCode !== null || child.signalCode !== null) return + // 1. Graceful: end the request stream (stdin EOF) and let the child quiesce + // on its own. Sending SIGTERM in the same tick (or too soon) would + // default-terminate a cooperative child mid-flush, orphaning its nested + // work. A child spawned without a stdin pipe skips straight to the wait. + child.stdin?.end() + if (await exitsWithin(child, graces.disposeEofGraceMs)) return + // 2. SIGTERM, escalating if the child still does not exit within the grace. + child.kill('SIGTERM') + if (await exitsWithin(child, graces.disposeGraceMs)) return + // 3. Force-kill and await the (now-certain) exit. + child.kill('SIGKILL') + await waitForExit(child) +} + +/** + * A per-run config directory handle for an external CLI child — the target of + * `CLAUDE_CONFIG_DIR` / `CODEX_HOME`-style redirection. Hand {@link path} to + * the child's environment; call {@link remove} on dispose. + */ +export interface IsolatedConfigDir { + /** The directory to point the child at. */ + path: string + /** + * Best-effort cleanup: removes the directory (recursively) iff this handle + * CREATED it — a pinned directory is never removed. Idempotent; never + * rejects (a leftover dir under the OS temp root is preferable to a failed + * dispose). + */ + remove(): Promise +} + +/** + * An isolated config dir for one child run, so the child's behavior is a + * function of deployment config alone — never of whatever `~/.claude` / + * `~/.codex`-style state happens to exist on the host machine. Two modes: + * + * - no `pinnedPath` (the default): creates a FRESH private (0700) `mkdtemp` + * dir under the OS temp root; {@link IsolatedConfigDir.remove} deletes it + * best-effort; + * - `pinnedPath` set (a deployment deliberately sharing state across runs): + * the pinned path is returned as-is — never created, never removed — the + * deployment owns that directory's lifecycle. + * + * @param prefix - the `mkdtemp` name prefix for a fresh dir (e.g. + * `dsh-subagent-codex-`); ignored when `pinnedPath` is set. + * @param pinnedPath - a deployment-pinned directory to use instead of a + * fresh one. + * @returns the directory handle: `path` for the child env, `remove()` for + * dispose. + */ +export async function createIsolatedConfigDir(prefix: string, pinnedPath?: string): Promise { + if (pinnedPath !== undefined) { + return { + path: pinnedPath, + remove(): Promise { + // A pinned dir is deployment-owned state (config the user asked to + // persist across runs); removing it here would destroy it. No-op. + return Promise.resolve() + }, + } + } + const path = await mkdtemp(join(tmpdir(), prefix)) + return { + path, + async remove(): Promise { + try { + await rm(path, { recursive: true, force: true }) + } catch { + // Best-effort by contract: swallows rm failures (EACCES/EBUSY-style — + // e.g. the dead child left an unreadable entry behind). The dir lives + // under the OS temp root, which reclaims it; failing dispose over + // cleanup would be worse than a leftover temp dir. + } + }, + } +} diff --git a/packages/subagent/subagent-process/tests/subagent-process.spec.ts b/packages/subagent/subagent-process/tests/subagent-process.spec.ts new file mode 100644 index 0000000000..c4828d8498 --- /dev/null +++ b/packages/subagent/subagent-process/tests/subagent-process.spec.ts @@ -0,0 +1,307 @@ +import { describe, expect, it } from 'vitest' +import { EventEmitter } from 'node:events' +import { existsSync } from 'node:fs' +import { chmod, mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import type { ChildProcess } from 'node:child_process' +import { + buildChildEnv, + createIsolatedConfigDir, + disposeChildProcess, + exitsWithin, + SENSITIVE_ENV_PATTERN, + spawnFailure, + waitForExit, +} from '../src/index.ts' + +/** + * Unit tests for the shared out-of-process machinery. The env scrub and the + * isolated-config-dir helpers run against the REAL process env and REAL + * filesystem; the exit waits and the dispose ladder run against a scriptable + * fake child so each escalation tier's timing is driven deterministically + * (the ACP backend's suite exercises the same ladder against real + * subprocesses end to end). + */ + +/** What fells a scripted {@link FakeChild}. */ +type LethalTrigger = 'eof' | NodeJS.Signals + +/** Per-scenario script for a {@link FakeChild}. */ +interface FakeChildScript { + /** + * The one trigger that makes the child exit (SIGKILL always does, + * uncatchable, like a real process). Omitted: only SIGKILL fells it. + */ + diesOn?: LethalTrigger + /** Delay (ms) between the lethal trigger and the exit event. */ + delayMs?: number + /** `false` models a child spawned without a stdin pipe. */ + stdin?: boolean +} + +/** + * A scriptable stand-in for a ChildProcess carrying exactly the surface the + * helpers read: `exitCode`/`signalCode`, `stdin.end()`, `kill()`, and the + * `exit` event. + */ +class FakeChild extends EventEmitter { + exitCode: number | null = null + signalCode: NodeJS.Signals | null = null + readonly kills: NodeJS.Signals[] = [] + stdinEnded = false + readonly stdin: { end: () => void } | null + + constructor(private readonly script: FakeChildScript = {}) { + super() + this.stdin = script.stdin === false + ? null + : { end: () => { this.stdinEnded = true; this.maybeDie('eof') } } + } + + kill(signal: NodeJS.Signals): boolean { + this.kills.push(signal) + this.maybeDie(signal) + return true + } + + private maybeDie(trigger: LethalTrigger): void { + // SIGKILL is uncatchable — it always fells the child; any other trigger + // only when the scenario scripts it as the lethal one. + if (trigger !== 'SIGKILL' && this.script.diesOn !== trigger) return + setTimeout(() => { + if (trigger === 'eof') this.exitCode = 0 + else this.signalCode = trigger + this.emit('exit', this.exitCode, this.signalCode) + }, this.script.delayMs ?? 0) + } +} + +/** The helpers take a real ChildProcess; the fake carries the read surface. */ +function asChild(fake: FakeChild): ChildProcess { + return fake as unknown as ChildProcess +} + +describe('buildChildEnv / SENSITIVE_ENV_PATTERN', () => { + it('drops credential-shaped ambient vars (KEY/SECRET/TOKEN, case-insensitive)', () => { + process.env.DSH_PROC_TEST_API_KEY = 'leak' + process.env.dsh_proc_test_secret = 'leak' + process.env.DSH_PROC_TEST_TOKEN = 'leak' + try { + const env = buildChildEnv({}) + expect(env.DSH_PROC_TEST_API_KEY).toBeUndefined() + expect(env.dsh_proc_test_secret).toBeUndefined() + expect(env.DSH_PROC_TEST_TOKEN).toBeUndefined() + } finally { + delete process.env.DSH_PROC_TEST_API_KEY + delete process.env.dsh_proc_test_secret + delete process.env.DSH_PROC_TEST_TOKEN + } + }) + + it('forwards normal ambient vars', () => { + expect(SENSITIVE_ENV_PATTERN.test('PATH')).toBe(false) + expect(buildChildEnv({}).PATH).toBe(process.env.PATH) + }) + + it('layers extras AFTER the scrub, so a deliberate credential-shaped name survives', () => { + process.env.DSH_PROC_TEST_EXTRA_TOKEN = 'ambient-leak' + try { + const env = buildChildEnv({ DSH_PROC_TEST_EXTRA_TOKEN: 'explicit' }) + // The ambient value was scrubbed; ONLY the explicit opt-in reaches the child. + expect(env.DSH_PROC_TEST_EXTRA_TOKEN).toBe('explicit') + } finally { + delete process.env.DSH_PROC_TEST_EXTRA_TOKEN + } + }) + + it('an extra overrides the ambient value of a non-credential var', () => { + process.env.DSH_PROC_TEST_PLAIN = 'ambient' + try { + expect(buildChildEnv({ DSH_PROC_TEST_PLAIN: 'override' }).DSH_PROC_TEST_PLAIN).toBe('override') + } finally { + delete process.env.DSH_PROC_TEST_PLAIN + } + }) +}) + +describe('spawnFailure', () => { + it('resolves (never rejects) with the first error event', async () => { + const fake = new FakeChild() + const failure = spawnFailure(asChild(fake)) + const err = new Error('spawn ENOENT') + fake.emit('error', err) + await expect(failure).resolves.toBe(err) + }) + + it('never settles for a child that spawns cleanly and exits', async () => { + const fake = new FakeChild({ diesOn: 'SIGTERM' }) + const failure = spawnFailure(asChild(fake)) + fake.kill('SIGTERM') + await waitForExit(asChild(fake)) + // A clean lifecycle emits `exit`, never `error` — the capture stays + // pending forever, so a race against it is decided by the other arms. + const settled = await Promise.race([ + failure.then(() => 'settled'), + new Promise(resolve => setTimeout(() => { resolve('pending') }, 30)), + ]) + expect(settled).toBe('pending') + }) +}) + +describe('waitForExit / exitsWithin', () => { + it('resolves immediately for a child that already exited by code', async () => { + const fake = new FakeChild() + fake.exitCode = 0 + await expect(waitForExit(asChild(fake))).resolves.toBeUndefined() + }) + + it('resolves immediately for a child that already died by signal', async () => { + const fake = new FakeChild() + fake.signalCode = 'SIGTERM' + await expect(waitForExit(asChild(fake))).resolves.toBeUndefined() + }) + + it('resolves on the exit event of a live child', async () => { + const fake = new FakeChild({ diesOn: 'SIGTERM', delayMs: 5 }) + const exited = waitForExit(asChild(fake)) + fake.kill('SIGTERM') + await expect(exited).resolves.toBeUndefined() + expect(fake.signalCode).toBe('SIGTERM') + }) + + it('exitsWithin resolves true when the child exits inside the window', async () => { + const fake = new FakeChild({ diesOn: 'SIGTERM', delayMs: 5 }) + fake.kill('SIGTERM') + await expect(exitsWithin(asChild(fake), 1000)).resolves.toBe(true) + }) + + it('exitsWithin resolves false on timeout for a child that never exits', async () => { + const fake = new FakeChild() // nothing short of SIGKILL fells it; no signal sent + await expect(exitsWithin(asChild(fake), 20)).resolves.toBe(false) + }) +}) + +describe('disposeChildProcess', () => { + it('returns immediately for an already-exited child (no EOF, no signals)', async () => { + const fake = new FakeChild() + fake.exitCode = 0 + await disposeChildProcess(asChild(fake), { disposeEofGraceMs: 1000, disposeGraceMs: 1000 }) + expect(fake.stdinEnded).toBe(false) + expect(fake.kills).toEqual([]) + }) + + it('returns immediately for a child already dead by signal', async () => { + const fake = new FakeChild() + fake.signalCode = 'SIGKILL' + await disposeChildProcess(asChild(fake), { disposeEofGraceMs: 1000, disposeGraceMs: 1000 }) + expect(fake.stdinEnded).toBe(false) + expect(fake.kills).toEqual([]) + }) + + it('tier 1: a cooperative child quiesces on stdin EOF — no signal is ever sent', async () => { + const fake = new FakeChild({ diesOn: 'eof', delayMs: 5 }) + await disposeChildProcess(asChild(fake), { disposeEofGraceMs: 1000, disposeGraceMs: 1000 }) + expect(fake.stdinEnded).toBe(true) + expect(fake.kills).toEqual([]) + expect(fake.exitCode).toBe(0) + }) + + it('tier 2: a child that ignores EOF but honors SIGTERM dies on the middle rung', async () => { + const fake = new FakeChild({ diesOn: 'SIGTERM', delayMs: 5 }) + await disposeChildProcess(asChild(fake), { disposeEofGraceMs: 20, disposeGraceMs: 1000 }) + expect(fake.stdinEnded).toBe(true) + expect(fake.kills).toEqual(['SIGTERM']) + expect(fake.signalCode).toBe('SIGTERM') + }) + + it('tier 3: a SIGTERM-trapping child is SIGKILLed, and dispose resolves only after the exit', async () => { + const fake = new FakeChild({ delayMs: 5 }) // only SIGKILL fells it + await disposeChildProcess(asChild(fake), { disposeEofGraceMs: 20, disposeGraceMs: 20 }) + expect(fake.kills).toEqual(['SIGTERM', 'SIGKILL']) + // Quiescence, not a request: at resolution the child has ACTUALLY exited + // (the exit event landed, despite the scripted post-SIGKILL delay). + expect(fake.signalCode).toBe('SIGKILL') + }) + + it('walks the ladder for a child spawned without a stdin pipe', async () => { + const fake = new FakeChild({ stdin: false, diesOn: 'SIGTERM', delayMs: 5 }) + await disposeChildProcess(asChild(fake), { disposeEofGraceMs: 20, disposeGraceMs: 1000 }) + expect(fake.kills).toEqual(['SIGTERM']) + }) +}) + +describe('createIsolatedConfigDir', () => { + it('creates a fresh private mkdtemp dir under the OS temp root', async () => { + const dir = await createIsolatedConfigDir('dsh-subagent-process-test-') + try { + expect(dir.path.startsWith(join(tmpdir(), 'dsh-subagent-process-test-'))).toBe(true) + const st = await stat(dir.path) + expect(st.isDirectory()).toBe(true) + // Private (0700) per the defensive-patterns temp-dir rule. + expect(st.mode & 0o777).toBe(0o700) + } finally { + await dir.remove() + } + }) + + it('creates a distinct dir per call (per-run isolation)', async () => { + const a = await createIsolatedConfigDir('dsh-subagent-process-test-') + const b = await createIsolatedConfigDir('dsh-subagent-process-test-') + try { + expect(a.path).not.toBe(b.path) + } finally { + await a.remove() + await b.remove() + } + }) + + it('remove() deletes a fresh dir recursively and is idempotent', async () => { + const dir = await createIsolatedConfigDir('dsh-subagent-process-test-') + await writeFile(join(dir.path, 'settings.json'), '{}') + await dir.remove() + expect(existsSync(dir.path)).toBe(false) + // Second remove: nothing left to delete, still resolves. + await expect(dir.remove()).resolves.toBeUndefined() + }) + + it('returns a pinned dir verbatim and NEVER removes it', async () => { + const pinned = await mkdtemp(join(tmpdir(), 'dsh-subagent-process-pinned-')) + try { + const dir = await createIsolatedConfigDir('ignored-prefix-', pinned) + expect(dir.path).toBe(pinned) + await dir.remove() + // The deployment owns a pinned dir's lifecycle — remove() must not touch it. + expect(existsSync(pinned)).toBe(true) + } finally { + await rm(pinned, { recursive: true, force: true }) + } + }) + + it('does not create a missing pinned path (the deployment owns its lifecycle)', async () => { + const missing = join(tmpdir(), `dsh-subagent-process-missing-${process.pid}`) + const dir = await createIsolatedConfigDir('ignored-prefix-', missing) + expect(dir.path).toBe(missing) + expect(existsSync(missing)).toBe(false) + await dir.remove() + expect(existsSync(missing)).toBe(false) + }) + + it('remove() is best-effort: an rm failure resolves instead of rejecting', async () => { + const dir = await createIsolatedConfigDir('dsh-subagent-process-locked-') + const locked = join(dir.path, 'locked') + await mkdir(locked) + await writeFile(join(locked, 'entry'), 'x') + // An unreadable, unwritable non-empty subdir makes recursive rm fail + // (EACCES on readdir/unlink) for a non-root user. + await chmod(locked, 0o000) + try { + await expect(dir.remove()).resolves.toBeUndefined() + // rm really did fail — the locked subtree is still there. + expect(existsSync(locked)).toBe(true) + } finally { + await chmod(locked, 0o700) + await rm(dir.path, { recursive: true, force: true }) + } + }) +}) diff --git a/packages/subagent/subagent-process/tsconfig.json b/packages/subagent/subagent-process/tsconfig.json new file mode 100644 index 0000000000..749cb0208e --- /dev/null +++ b/packages/subagent/subagent-process/tsconfig.json @@ -0,0 +1,11 @@ +{ + "extends": "../../../tsconfig.base.json", + "compilerOptions": { + "rootDir": "src", + "outDir": "lib/types" + }, + "include": [ + "src" + ], + "references": [] +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 32ffa0d389..359b68b6d5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -594,6 +594,9 @@ importers: '@deepseek-ai/dsh-subagent': specifier: workspace:^ version: link:../subagent + '@deepseek-ai/dsh-subagent-process': + specifier: workspace:^ + version: link:../subagent-process cordis: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) @@ -671,6 +674,12 @@ importers: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) + packages/subagent/subagent-process: + devDependencies: + cordis: + specifier: ^4.0.0-rc.6 + version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) + packages/subagent/subagent-spawn: dependencies: schemastery: diff --git a/tsconfig.build.json b/tsconfig.build.json index 3d99ad4e28..21fa726927 100644 --- a/tsconfig.build.json +++ b/tsconfig.build.json @@ -50,6 +50,7 @@ { "path": "./packages/support/subagent-mock" }, { "path": "./packages/subagent/tool-subagent" }, { "path": "./packages/subagent/subagent-inprocess" }, + { "path": "./packages/subagent/subagent-process" }, { "path": "./packages/subagent/subagent-spawn" }, { "path": "./packages/subagent/subagent-fork" }, { "path": "./packages/subagent/subagent-acp" }, diff --git a/tsconfig.json b/tsconfig.json index 2091283c93..c4127b2b5d 100644 --- a/tsconfig.json +++ b/tsconfig.json @@ -61,6 +61,7 @@ { "path": "./packages/support/subagent-mock" }, { "path": "./packages/subagent/tool-subagent" }, { "path": "./packages/subagent/subagent-inprocess" }, + { "path": "./packages/subagent/subagent-process" }, { "path": "./packages/subagent/subagent-spawn" }, { "path": "./packages/subagent/subagent-fork" }, { "path": "./packages/subagent/subagent-acp" }, From 7ccf31a59b5227d66a95b2d52932d68b59e2b702 Mon Sep 17 00:00:00 2001 From: pku-xht Date: Thu, 9 Jul 2026 10:20:42 +0800 Subject: [PATCH 2/8] fix review finding: root-portable rm-failure injection in the config-dir test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The best-effort-remove test provoked a real EACCES via a chmod-000 subtree, which only fails for unprivileged users — under root, recursive rm ignores permission bits, deleting the subtree: the existsSync assertion goes red and the swallow branch loses coverage, failing the per-file gate. The rejection is now injected deterministically at the node:fs/promises boundary (rm wrapped with a real-passthrough vi.fn; one test queues a single rejection), the fs-failure boundary being exactly the non-deterministic seam the testing policy sanctions mocking. Everything else in the suite stays on the real filesystem, and the swallow contract stays error-kind agnostic. --- packages/subagent/subagent-process/README.md | 2 +- .../tests/subagent-process.spec.ts | 39 +++++++++++-------- 2 files changed, 24 insertions(+), 17 deletions(-) diff --git a/packages/subagent/subagent-process/README.md b/packages/subagent/subagent-process/README.md index 597470f52a..e42bb4b611 100644 --- a/packages/subagent/subagent-process/README.md +++ b/packages/subagent/subagent-process/README.md @@ -37,4 +37,4 @@ A per-run isolated config directory for an external CLI child (the target of `CL ## Testing -`tests/subagent-process.spec.ts`: the env scrub and config-dir helpers run against the real process env and real filesystem (including an rm-failure path proving `remove()` never rejects); the exit waits and the dispose ladder run against a scriptable fake child, driving each escalation tier deterministically. The [ACP backend suite](../subagent-acp/README.md) exercises the same ladder against real subprocesses (EOF-cooperative, EOF-ignoring, and SIGTERM-trapping children) end to end. +`tests/subagent-process.spec.ts`: the env scrub and config-dir helpers run against the real process env and real filesystem (the rm-failure path injects its rejection at the fs boundary — a real recursive-rm failure is not portably provokable, and root ignores permission bits); the exit waits and the dispose ladder run against a scriptable fake child, driving each escalation tier deterministically. The [ACP backend suite](../subagent-acp/README.md) exercises the same ladder against real subprocesses (EOF-cooperative, EOF-ignoring, and SIGTERM-trapping children) end to end. diff --git a/packages/subagent/subagent-process/tests/subagent-process.spec.ts b/packages/subagent/subagent-process/tests/subagent-process.spec.ts index c4828d8498..24f2a3a97d 100644 --- a/packages/subagent/subagent-process/tests/subagent-process.spec.ts +++ b/packages/subagent/subagent-process/tests/subagent-process.spec.ts @@ -1,7 +1,7 @@ -import { describe, expect, it } from 'vitest' +import { describe, expect, it, vi } from 'vitest' import { EventEmitter } from 'node:events' import { existsSync } from 'node:fs' -import { chmod, mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises' +import { mkdtemp, rm, stat, writeFile } from 'node:fs/promises' import { tmpdir } from 'node:os' import { join } from 'node:path' import type { ChildProcess } from 'node:child_process' @@ -15,13 +15,24 @@ import { waitForExit, } from '../src/index.ts' +// `rm` is wrapped (real-passthrough by default) so ONE test can inject a +// rejection deterministically. A real recursive-rm failure is not portably +// provokable — permission tricks (a chmod-000 subtree) fail only for +// unprivileged users and are ignored by root — so this is the fs boundary +// the testing policy sanctions mocking; everything else stays the real fs. +vi.mock('node:fs/promises', async (importOriginal) => { + const actual = await importOriginal() + return { ...actual, rm: vi.fn(actual.rm) } +}) + /** * Unit tests for the shared out-of-process machinery. The env scrub and the * isolated-config-dir helpers run against the REAL process env and REAL - * filesystem; the exit waits and the dispose ladder run against a scriptable - * fake child so each escalation tier's timing is driven deterministically - * (the ACP backend's suite exercises the same ladder against real - * subprocesses end to end). + * filesystem (one exception: the rm-failure path injects its rejection at the + * mocked fs boundary, see above); the exit waits and the dispose ladder run + * against a scriptable fake child so each escalation tier's timing is driven + * deterministically (the ACP backend's suite exercises the same ladder + * against real subprocesses end to end). */ /** What fells a scripted {@link FakeChild}. */ @@ -287,20 +298,16 @@ describe('createIsolatedConfigDir', () => { expect(existsSync(missing)).toBe(false) }) - it('remove() is best-effort: an rm failure resolves instead of rejecting', async () => { + it('remove() is best-effort: an rm rejection resolves instead of rejecting', async () => { const dir = await createIsolatedConfigDir('dsh-subagent-process-locked-') - const locked = join(dir.path, 'locked') - await mkdir(locked) - await writeFile(join(locked, 'entry'), 'x') - // An unreadable, unwritable non-empty subdir makes recursive rm fail - // (EACCES on readdir/unlink) for a non-root user. - await chmod(locked, 0o000) try { + // The swallow contract is error-kind agnostic; EACCES stands in for the + // family (EBUSY, a vanished mount, …) that best-effort must absorb. + vi.mocked(rm).mockRejectedValueOnce(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' })) await expect(dir.remove()).resolves.toBeUndefined() - // rm really did fail — the locked subtree is still there. - expect(existsSync(locked)).toBe(true) + // The injected rejection consumed the only rm call — nothing was deleted. + expect(existsSync(dir.path)).toBe(true) } finally { - await chmod(locked, 0o700) await rm(dir.path, { recursive: true, force: true }) } }) From 2471e2b2bb45d1f8f350571451feda04a4a8786d Mon Sep 17 00:00:00 2001 From: pku-xht Date: Thu, 9 Jul 2026 10:42:34 +0800 Subject: [PATCH 3/8] fix review finding: exitsWithin cleans up its listener and timer on both arms Each timed-out wait used to leave the once('exit') listener from its inner waitForExit attached to the child; the dispose ladder accumulates at most a couple, but in a shared library a caller polling exitsWithin in a loop would pile listeners onto one child (MaxListenersExceededWarning at 11) and retain their closures. The race now owns its wiring: the timeout arm removes the exit listener, the exit arm clears the (still unref'ed) grace timer, and an already-exited child short-circuits true without attaching anything. Tests pin listenerCount('exit') === 0 after every outcome. --- packages/subagent/subagent-process/README.md | 2 +- .../subagent/subagent-process/src/index.ts | 24 ++++++++++++++----- .../tests/subagent-process.spec.ts | 12 ++++++++++ 3 files changed, 31 insertions(+), 7 deletions(-) diff --git a/packages/subagent/subagent-process/README.md b/packages/subagent/subagent-process/README.md index e42bb4b611..e6c8e10a96 100644 --- a/packages/subagent/subagent-process/README.md +++ b/packages/subagent/subagent-process/README.md @@ -16,7 +16,7 @@ Spawn-failure capture: a promise that resolves (never rejects) with the child's ### `waitForExit(child)` / `exitsWithin(child, ms)` -Exit waits over a `ChildProcess`: resolve once the child exits by any code or signal (immediately if it is already gone), or race that against a timer (`true` = exited in time; the pending timer is `unref()`ed so a grace window never keeps the parent's event loop alive). +Exit waits over a `ChildProcess`: resolve once the child exits by any code or signal (immediately if it is already gone), or race that against a timer (`true` = exited in time). The race cleans up after itself on both outcomes — the pending timer is `unref()`ed and cleared on exit, the exit listener removed on timeout — so repeated calls (the dispose ladder's tiers, a poll loop) never accumulate listeners on the child. ### `disposeChildProcess(child, graces)` diff --git a/packages/subagent/subagent-process/src/index.ts b/packages/subagent/subagent-process/src/index.ts index b54681d3c7..219ed6b083 100644 --- a/packages/subagent/subagent-process/src/index.ts +++ b/packages/subagent/subagent-process/src/index.ts @@ -78,17 +78,29 @@ export function waitForExit(child: ChildProcess): Promise { } /** - * Race the child's exit against a timer. + * Race the child's exit against a timer. Neither outcome leaves anything + * behind on the child: the exit listener is removed on timeout and the timer + * is cleared on exit, so repeated calls (the dispose ladder's tiers, a poll + * loop) never accumulate listeners. * @param child - the child process to watch. * @param ms - the wait window in milliseconds. - * @returns `true` if the child exits within `ms`, `false` on timeout. + * @returns `true` if the child exits within `ms` (immediately if it is + * already gone), `false` on timeout. */ export function exitsWithin(child: ChildProcess, ms: number): Promise { - return Promise.race([ - waitForExit(child).then(() => true), + if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true) + return new Promise((resolve) => { + const onExit = (): void => { + clearTimeout(timer) + resolve(true) + } // `.unref()` so a pending grace timer never keeps the parent's loop alive. - new Promise(resolve => setTimeout(() => { resolve(false) }, ms).unref()), - ]) + const timer = setTimeout(() => { + child.removeListener('exit', onExit) + resolve(false) + }, ms).unref() + child.once('exit', onExit) + }) } /** diff --git a/packages/subagent/subagent-process/tests/subagent-process.spec.ts b/packages/subagent/subagent-process/tests/subagent-process.spec.ts index 24f2a3a97d..d23f075284 100644 --- a/packages/subagent/subagent-process/tests/subagent-process.spec.ts +++ b/packages/subagent/subagent-process/tests/subagent-process.spec.ts @@ -181,15 +181,27 @@ describe('waitForExit / exitsWithin', () => { expect(fake.signalCode).toBe('SIGTERM') }) + it('exitsWithin resolves true immediately for an already-exited child (no listener attached)', async () => { + const fake = new FakeChild() + fake.exitCode = 0 + await expect(exitsWithin(asChild(fake), 1000)).resolves.toBe(true) + expect(fake.listenerCount('exit')).toBe(0) + }) + it('exitsWithin resolves true when the child exits inside the window', async () => { const fake = new FakeChild({ diesOn: 'SIGTERM', delayMs: 5 }) fake.kill('SIGTERM') await expect(exitsWithin(asChild(fake), 1000)).resolves.toBe(true) + // The once-listener fired and the grace timer was cleared — nothing lingers. + expect(fake.listenerCount('exit')).toBe(0) }) it('exitsWithin resolves false on timeout for a child that never exits', async () => { const fake = new FakeChild() // nothing short of SIGKILL fells it; no signal sent await expect(exitsWithin(asChild(fake), 20)).resolves.toBe(false) + // The timeout arm removed its exit listener: repeated waits (a poll loop, + // the ladder's tiers) never accumulate listeners on the same child. + expect(fake.listenerCount('exit')).toBe(0) }) }) From a11000030a14dd382548839894ba49b0568ab801 Mon Sep 17 00:00:00 2001 From: pku-xht Date: Thu, 9 Jul 2026 10:42:41 +0800 Subject: [PATCH 4/8] docs(subagent-acp): point the env-scrub section at its one home MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scrub pattern and layering semantics live in the dsh-subagent-process README (the fact's home since the extraction); the ACP section restated them in full — two prose copies drift word by word until they disagree (the one-home-per-fact rule in docs/AGENTS.md). The section now links the library and keeps only the backend's own story: which credential enters via config.env and why. --- packages/subagent/subagent-acp/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/subagent/subagent-acp/README.md b/packages/subagent/subagent-acp/README.md index 81bf886067..2cc330aefd 100644 --- a/packages/subagent/subagent-acp/README.md +++ b/packages/subagent/subagent-acp/README.md @@ -57,7 +57,7 @@ A spawn/transport/RPC failure resolves `error` (or `aborted` if a cancel was req ## Environment scrub -Credential-shaped ambient vars (`/KEY|SECRET|TOKEN/i`) are NOT forwarded to the child by default — the parent harness's own secrets must not leak into a spawned process implicitly. The child's OWN credentials are supplied explicitly via `config.env`, layered AFTER the scrub, so an intended `DEEPSEEK_API_KEY` survives while an incidental `AWS_SECRET_ACCESS_KEY` does not. +The child env is built by [`buildChildEnv` from `@deepseek-ai/dsh-subagent-process`](../subagent-process/README.md) — the ambient env minus credential-shaped vars, with `config.env` layered on top after the scrub; the pattern and full semantics live there. For this backend that means the parent harness's own secrets never leak into the spawned agent implicitly, while the child's OWN `DEEPSEEK_API_KEY` is supplied deliberately via `config.env` and survives. ## Testing From c321819053c29468f79adb87dc66c7ff22f37668 Mon Sep 17 00:00:00 2001 From: pku-xht Date: Thu, 9 Jul 2026 13:42:03 +0800 Subject: [PATCH 5/8] rename: @deepseek-ai/dsh-subagent-process -> @deepseek-ai/dsh-subagent-subprocess MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The extracted library's name sat one edit away from @deepseek-ai/dsh-subagent-inprocess (process/inprocess), inviting a typo'd import to silently resolve to the wrong package. subagent-subprocess also reads as the deliberate counterpart to subagent-inprocess (in-process vs. subprocess), matching how the two shared drivers actually differ. Package directory, npm name, module doc, JSDoc module tags, test-file name and its temp-dir prefixes, the subagent-acp import and its Config/tsconfig/package.json references, root tsconfig.json/tsconfig.build.json/knip.json entries, and the packages/subagent group README all renamed together; regenerated docs/module-graph.md and docs/config-catalog.md. Pure rename — no behavior, export, or Config shape changed. --- docs/config-catalog.md | 2 +- docs/module-graph.md | 8 ++++---- knip.json | 2 +- packages/subagent/README.md | 4 ++-- packages/subagent/subagent-acp/README.md | 2 +- packages/subagent/subagent-acp/package.json | 4 ++-- packages/subagent/subagent-acp/src/run.ts | 2 +- .../subagent-acp/tests/subagent-acp.spec.ts | 2 +- packages/subagent/subagent-acp/tsconfig.json | 2 +- .../README.md | 4 ++-- .../package.json | 2 +- .../src/index.ts | 2 +- .../tests/subagent-subprocess.spec.ts} | 16 ++++++++-------- .../tsconfig.json | 0 pnpm-lock.yaml | 16 ++++++++-------- tsconfig.build.json | 2 +- tsconfig.json | 2 +- 17 files changed, 36 insertions(+), 36 deletions(-) rename packages/subagent/{subagent-process => subagent-subprocess}/README.md (86%) rename packages/subagent/{subagent-process => subagent-subprocess}/package.json (93%) rename packages/subagent/{subagent-process => subagent-subprocess}/src/index.ts (99%) rename packages/subagent/{subagent-process/tests/subagent-process.spec.ts => subagent-subprocess/tests/subagent-subprocess.spec.ts} (94%) rename packages/subagent/{subagent-process => subagent-subprocess}/tsconfig.json (100%) diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 34cb543303..642a4d719a 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -884,4 +884,4 @@ Imported as libraries by other packages; a `cordis.yml` cannot load them. - `@deepseek-ai/dsh-brand` ([`packages/util/brand/src/index.ts`](../packages/util/brand/src/index.ts)) - `@deepseek-ai/dsh-hook-protocol` ([`packages/hooks/hook-protocol/src/index.ts`](../packages/hooks/hook-protocol/src/index.ts)) - `@deepseek-ai/dsh-subagent-inprocess` ([`packages/subagent/subagent-inprocess/src/index.ts`](../packages/subagent/subagent-inprocess/src/index.ts)) -- `@deepseek-ai/dsh-subagent-process` ([`packages/subagent/subagent-process/src/index.ts`](../packages/subagent/subagent-process/src/index.ts)) +- `@deepseek-ai/dsh-subagent-subprocess` ([`packages/subagent/subagent-subprocess/src/index.ts`](../packages/subagent/subagent-subprocess/src/index.ts)) diff --git a/docs/module-graph.md b/docs/module-graph.md index 57fb397e54..c0e64c1d36 100644 --- a/docs/module-graph.md +++ b/docs/module-graph.md @@ -43,8 +43,8 @@ flowchart TD pkg_subagent_acp["subagent-acp"] pkg_subagent_fork["subagent-fork"] pkg_subagent_inprocess["subagent-inprocess"] - pkg_subagent_process["subagent-process"] pkg_subagent_spawn["subagent-spawn"] + pkg_subagent_subprocess["subagent-subprocess"] pkg_tool_subagent["tool-subagent"] end subgraph group_web["packages/web"] @@ -179,7 +179,7 @@ flowchart TD pkg_subagent_acp --> pkg_agent pkg_subagent_acp --> pkg_llm pkg_subagent_acp --> pkg_subagent - pkg_subagent_acp --> pkg_subagent_process + pkg_subagent_acp --> pkg_subagent_subprocess pkg_subagent_inprocess --> pkg_agent pkg_subagent_inprocess --> pkg_llm pkg_subagent_inprocess --> pkg_session @@ -220,7 +220,7 @@ flowchart TD | Package | Group | Depends on | | --- | --- | --- | | [`brand`](../packages/util/brand) | `util` | — | -| [`subagent-process`](../packages/subagent/subagent-process) | `subagent` | — | +| [`subagent-subprocess`](../packages/subagent/subagent-subprocess) | `subagent` | — | | [`acp-snapshot`](../packages/support/acp-snapshot) | `support` | — | | [`app-boot`](../packages/ui/app-boot) | `ui` | — | | [`code-runtime`](../packages/code-runtime/code-runtime) | `code-runtime` | — | @@ -260,7 +260,7 @@ flowchart TD | [`acp`](../packages/ui/acp) | `ui` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`tools`](../packages/core/tools) | | [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | `guard` | [`agent`](../packages/core/agent), [`tools`](../packages/core/tools) | | [`agent-core`](../packages/core/agent-core) | `core` | [`agent`](../packages/core/agent), [`agent-loop`](../packages/core/agent-loop), [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`tool-bash`](../packages/bash/tool-bash), [`tools`](../packages/core/tools) | -| [`subagent-acp`](../packages/subagent/subagent-acp) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`subagent-process`](../packages/subagent/subagent-process) | +| [`subagent-acp`](../packages/subagent/subagent-acp) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`subagent-subprocess`](../packages/subagent/subagent-subprocess) | | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) | | [`tool-subagent`](../packages/subagent/tool-subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) | | [`hooks-claude`](../packages/hooks/hooks-claude) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) | diff --git a/knip.json b/knip.json index d4c44e9aa5..ecfd431c1c 100644 --- a/knip.json +++ b/knip.json @@ -70,7 +70,7 @@ "entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts", "tests/mock-acp-server.ts"], "project": ["src/**/*.ts", "tests/**/*.ts"] }, - "packages/subagent/subagent-process": { + "packages/subagent/subagent-subprocess": { "entry": ["tests/**/*.spec.ts"], "project": ["src/**/*.ts", "tests/**/*.ts"], "ignoreDependencies": ["cordis"] diff --git a/packages/subagent/README.md b/packages/subagent/README.md index 38c64d22a5..87930167e9 100644 --- a/packages/subagent/README.md +++ b/packages/subagent/README.md @@ -8,10 +8,10 @@ The subagent seam: an agent delegating work to a child agent. Like the [bash](.. | `subagent-inprocess/` | Shared in-process run driver (pure lib; registers nothing) | — | | `subagent-spawn/` | In-process backend: a fresh child agent | (registers on `ctx.subagents`) | | `subagent-fork/` | In-process backend: a child seeded with the parent's completed-turn prefix | (registers on `ctx.subagents`) | -| `subagent-process/` | Shared out-of-process machinery: env scrub, dispose ladder, isolated config dirs (pure lib; registers nothing) | — | +| `subagent-subprocess/` | Shared out-of-process machinery: env scrub, dispose ladder, isolated config dirs (pure lib; registers nothing) | — | | `subagent-acp/` | Out-of-process backend: a child agent in a spawned subprocess, driven over ACP | (registers on `ctx.subagents`) | | `tool-subagent/` | Model-facing `subagent` delegation tool over `ctx.subagents` | (registers on `ctx.tools`) | -The interface lives at `subagent/subagent/`. The in-process `subagent-spawn` / `subagent-fork` backends share the `subagent-inprocess` driver (a pure library — both depend on it, neither on the other), the out-of-process `subagent-acp` backend builds on the `subagent-process` library (the credential env scrub, the dispose ladder, isolated config dirs) and ships alongside them here; the test-only `dsh-subagent-mock` (in [support](../support/README.md)) is separate. All **product** packages except the mock. +The interface lives at `subagent/subagent/`. The in-process `subagent-spawn` / `subagent-fork` backends share the `subagent-inprocess` driver (a pure library — both depend on it, neither on the other), the out-of-process `subagent-acp` backend builds on the `subagent-subprocess` library (the credential env scrub, the dispose ladder, isolated config dirs) and ships alongside them here; the test-only `dsh-subagent-mock` (in [support](../support/README.md)) is separate. All **product** packages except the mock. The proposal and design rationale: [docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md](../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md). diff --git a/packages/subagent/subagent-acp/README.md b/packages/subagent/subagent-acp/README.md index 2cc330aefd..7fb087dcdc 100644 --- a/packages/subagent/subagent-acp/README.md +++ b/packages/subagent/subagent-acp/README.md @@ -57,7 +57,7 @@ A spawn/transport/RPC failure resolves `error` (or `aborted` if a cancel was req ## Environment scrub -The child env is built by [`buildChildEnv` from `@deepseek-ai/dsh-subagent-process`](../subagent-process/README.md) — the ambient env minus credential-shaped vars, with `config.env` layered on top after the scrub; the pattern and full semantics live there. For this backend that means the parent harness's own secrets never leak into the spawned agent implicitly, while the child's OWN `DEEPSEEK_API_KEY` is supplied deliberately via `config.env` and survives. +The child env is built by [`buildChildEnv` from `@deepseek-ai/dsh-subagent-subprocess`](../subagent-subprocess/README.md) — the ambient env minus credential-shaped vars, with `config.env` layered on top after the scrub; the pattern and full semantics live there. For this backend that means the parent harness's own secrets never leak into the spawned agent implicitly, while the child's OWN `DEEPSEEK_API_KEY` is supplied deliberately via `config.env` and survives. ## Testing diff --git a/packages/subagent/subagent-acp/package.json b/packages/subagent/subagent-acp/package.json index 45fc6b072c..e73d861a79 100644 --- a/packages/subagent/subagent-acp/package.json +++ b/packages/subagent/subagent-acp/package.json @@ -25,7 +25,7 @@ "@deepseek-ai/dsh-agent": "^0.0.1", "@deepseek-ai/dsh-llm": "^0.0.1", "@deepseek-ai/dsh-subagent": "^0.0.1", - "@deepseek-ai/dsh-subagent-process": "^0.0.1", + "@deepseek-ai/dsh-subagent-subprocess": "^0.0.1", "cordis": "^4.0.0-rc.6" }, "dependencies": { @@ -36,7 +36,7 @@ "@deepseek-ai/dsh-agent": "workspace:^", "@deepseek-ai/dsh-llm": "workspace:^", "@deepseek-ai/dsh-subagent": "workspace:^", - "@deepseek-ai/dsh-subagent-process": "workspace:^", + "@deepseek-ai/dsh-subagent-subprocess": "workspace:^", "@cordisjs/plugin-loader": "^1.0.0-rc.4", "cordis": "^4.0.0-rc.6" } diff --git a/packages/subagent/subagent-acp/src/run.ts b/packages/subagent/subagent-acp/src/run.ts index a94c923f46..a9fefba27c 100644 --- a/packages/subagent/subagent-acp/src/run.ts +++ b/packages/subagent/subagent-acp/src/run.ts @@ -40,7 +40,7 @@ import { import { AgentId } from '@deepseek-ai/dsh-agent' import type { ContentBlock } from '@deepseek-ai/dsh-llm' import type { SubagentResult, SubagentRun, SubagentStartRequest, SubagentStopReason } from '@deepseek-ai/dsh-subagent' -import { buildChildEnv, disposeChildProcess, spawnFailure } from '@deepseek-ai/dsh-subagent-process' +import { buildChildEnv, disposeChildProcess, spawnFailure } from '@deepseek-ai/dsh-subagent-subprocess' /** * How the client answers a child's `session/request_permission`. The first cut diff --git a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts index 6d351c71d0..92c025077a 100644 --- a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts +++ b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts @@ -6,7 +6,7 @@ import { tmpdir } from 'node:os' import { join } from 'node:path' import { fileURLToPath } from 'node:url' import SubagentService from '@deepseek-ai/dsh-subagent' -import { buildChildEnv, SENSITIVE_ENV_PATTERN } from '@deepseek-ai/dsh-subagent-process' +import { buildChildEnv, SENSITIVE_ENV_PATTERN } from '@deepseek-ai/dsh-subagent-subprocess' import type { Agent } from '@deepseek-ai/dsh-agent' import * as acp from '../src/index.ts' import { acpStopReason, acpContentText, DEFAULT_DISPOSE_EOF_GRACE_MS, DEFAULT_DISPOSE_GRACE_MS, startAcpRun, toAcpPrompt, type AcpRunSpec } from '../src/run.ts' diff --git a/packages/subagent/subagent-acp/tsconfig.json b/packages/subagent/subagent-acp/tsconfig.json index ab24f60f93..e415ace1de 100644 --- a/packages/subagent/subagent-acp/tsconfig.json +++ b/packages/subagent/subagent-acp/tsconfig.json @@ -27,7 +27,7 @@ "path": "../subagent" }, { - "path": "../subagent-process" + "path": "../subagent-subprocess" } ] } diff --git a/packages/subagent/subagent-process/README.md b/packages/subagent/subagent-subprocess/README.md similarity index 86% rename from packages/subagent/subagent-process/README.md rename to packages/subagent/subagent-subprocess/README.md index e6c8e10a96..ccc68bf31b 100644 --- a/packages/subagent/subagent-process/README.md +++ b/packages/subagent/subagent-subprocess/README.md @@ -1,4 +1,4 @@ -# @deepseek-ai/dsh-subagent-process +# @deepseek-ai/dsh-subagent-subprocess Shared machinery for **out-of-process subagent backends** — providers that spawn an external agent as a child process, such as the [ACP backend](../subagent-acp/README.md). A pure library (no provider, no registration, no Config): what every spawn-a-CLI-child backend needs to keep the parent deployment's credentials out of the child, tear the child down to quiescence, and isolate it from the host user's on-disk CLI state. Design rationale: [the Claude Code / Codex subagent backends RFC](../../../docs/rfc/proposed/feature/2026-07-07-claude-code-and-codex-subagent-backends.md). @@ -37,4 +37,4 @@ A per-run isolated config directory for an external CLI child (the target of `CL ## Testing -`tests/subagent-process.spec.ts`: the env scrub and config-dir helpers run against the real process env and real filesystem (the rm-failure path injects its rejection at the fs boundary — a real recursive-rm failure is not portably provokable, and root ignores permission bits); the exit waits and the dispose ladder run against a scriptable fake child, driving each escalation tier deterministically. The [ACP backend suite](../subagent-acp/README.md) exercises the same ladder against real subprocesses (EOF-cooperative, EOF-ignoring, and SIGTERM-trapping children) end to end. +`tests/subagent-subprocess.spec.ts`: the env scrub and config-dir helpers run against the real process env and real filesystem (the rm-failure path injects its rejection at the fs boundary — a real recursive-rm failure is not portably provokable, and root ignores permission bits); the exit waits and the dispose ladder run against a scriptable fake child, driving each escalation tier deterministically. The [ACP backend suite](../subagent-acp/README.md) exercises the same ladder against real subprocesses (EOF-cooperative, EOF-ignoring, and SIGTERM-trapping children) end to end. diff --git a/packages/subagent/subagent-process/package.json b/packages/subagent/subagent-subprocess/package.json similarity index 93% rename from packages/subagent/subagent-process/package.json rename to packages/subagent/subagent-subprocess/package.json index 218276be44..68f525dd8e 100644 --- a/packages/subagent/subagent-process/package.json +++ b/packages/subagent/subagent-subprocess/package.json @@ -1,5 +1,5 @@ { - "name": "@deepseek-ai/dsh-subagent-process", + "name": "@deepseek-ai/dsh-subagent-subprocess", "description": "Shared out-of-process subagent machinery: credential env scrub, spawn-failure capture, child-exit waits, the EOF-to-SIGTERM-to-SIGKILL dispose ladder, and isolated config dirs (pure lib; registers nothing)", "version": "0.0.1", "private": true, diff --git a/packages/subagent/subagent-process/src/index.ts b/packages/subagent/subagent-subprocess/src/index.ts similarity index 99% rename from packages/subagent/subagent-process/src/index.ts rename to packages/subagent/subagent-subprocess/src/index.ts index 219ed6b083..35d7383456 100644 --- a/packages/subagent/subagent-process/src/index.ts +++ b/packages/subagent/subagent-subprocess/src/index.ts @@ -15,7 +15,7 @@ * periods, a pinned config dir — is a PARAMETER here: defaults belong in each * consuming plugin's Config, per the no-hardcoded-tunables rule. * - * @module @deepseek-ai/dsh-subagent-process + * @module @deepseek-ai/dsh-subagent-subprocess */ import type { ChildProcess } from 'node:child_process' diff --git a/packages/subagent/subagent-process/tests/subagent-process.spec.ts b/packages/subagent/subagent-subprocess/tests/subagent-subprocess.spec.ts similarity index 94% rename from packages/subagent/subagent-process/tests/subagent-process.spec.ts rename to packages/subagent/subagent-subprocess/tests/subagent-subprocess.spec.ts index d23f075284..2766ed0a41 100644 --- a/packages/subagent/subagent-process/tests/subagent-process.spec.ts +++ b/packages/subagent/subagent-subprocess/tests/subagent-subprocess.spec.ts @@ -256,9 +256,9 @@ describe('disposeChildProcess', () => { describe('createIsolatedConfigDir', () => { it('creates a fresh private mkdtemp dir under the OS temp root', async () => { - const dir = await createIsolatedConfigDir('dsh-subagent-process-test-') + const dir = await createIsolatedConfigDir('dsh-subagent-subprocess-test-') try { - expect(dir.path.startsWith(join(tmpdir(), 'dsh-subagent-process-test-'))).toBe(true) + expect(dir.path.startsWith(join(tmpdir(), 'dsh-subagent-subprocess-test-'))).toBe(true) const st = await stat(dir.path) expect(st.isDirectory()).toBe(true) // Private (0700) per the defensive-patterns temp-dir rule. @@ -269,8 +269,8 @@ describe('createIsolatedConfigDir', () => { }) it('creates a distinct dir per call (per-run isolation)', async () => { - const a = await createIsolatedConfigDir('dsh-subagent-process-test-') - const b = await createIsolatedConfigDir('dsh-subagent-process-test-') + const a = await createIsolatedConfigDir('dsh-subagent-subprocess-test-') + const b = await createIsolatedConfigDir('dsh-subagent-subprocess-test-') try { expect(a.path).not.toBe(b.path) } finally { @@ -280,7 +280,7 @@ describe('createIsolatedConfigDir', () => { }) it('remove() deletes a fresh dir recursively and is idempotent', async () => { - const dir = await createIsolatedConfigDir('dsh-subagent-process-test-') + const dir = await createIsolatedConfigDir('dsh-subagent-subprocess-test-') await writeFile(join(dir.path, 'settings.json'), '{}') await dir.remove() expect(existsSync(dir.path)).toBe(false) @@ -289,7 +289,7 @@ describe('createIsolatedConfigDir', () => { }) it('returns a pinned dir verbatim and NEVER removes it', async () => { - const pinned = await mkdtemp(join(tmpdir(), 'dsh-subagent-process-pinned-')) + const pinned = await mkdtemp(join(tmpdir(), 'dsh-subagent-subprocess-pinned-')) try { const dir = await createIsolatedConfigDir('ignored-prefix-', pinned) expect(dir.path).toBe(pinned) @@ -302,7 +302,7 @@ describe('createIsolatedConfigDir', () => { }) it('does not create a missing pinned path (the deployment owns its lifecycle)', async () => { - const missing = join(tmpdir(), `dsh-subagent-process-missing-${process.pid}`) + const missing = join(tmpdir(), `dsh-subagent-subprocess-missing-${process.pid}`) const dir = await createIsolatedConfigDir('ignored-prefix-', missing) expect(dir.path).toBe(missing) expect(existsSync(missing)).toBe(false) @@ -311,7 +311,7 @@ describe('createIsolatedConfigDir', () => { }) it('remove() is best-effort: an rm rejection resolves instead of rejecting', async () => { - const dir = await createIsolatedConfigDir('dsh-subagent-process-locked-') + const dir = await createIsolatedConfigDir('dsh-subagent-subprocess-locked-') try { // The swallow contract is error-kind agnostic; EACCES stands in for the // family (EBUSY, a vanished mount, …) that best-effort must absorb. diff --git a/packages/subagent/subagent-process/tsconfig.json b/packages/subagent/subagent-subprocess/tsconfig.json similarity index 100% rename from packages/subagent/subagent-process/tsconfig.json rename to packages/subagent/subagent-subprocess/tsconfig.json diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 248405f643..023588835a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -635,9 +635,9 @@ importers: '@deepseek-ai/dsh-subagent': specifier: workspace:^ version: link:../subagent - '@deepseek-ai/dsh-subagent-process': + '@deepseek-ai/dsh-subagent-subprocess': specifier: workspace:^ - version: link:../subagent-process + version: link:../subagent-subprocess cordis: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) @@ -715,12 +715,6 @@ importers: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) - packages/subagent/subagent-process: - devDependencies: - cordis: - specifier: ^4.0.0-rc.6 - version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) - packages/subagent/subagent-spawn: dependencies: schemastery: @@ -773,6 +767,12 @@ importers: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) + packages/subagent/subagent-subprocess: + devDependencies: + cordis: + specifier: ^4.0.0-rc.6 + version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) + packages/subagent/tool-subagent: dependencies: schemastery: diff --git a/tsconfig.build.json b/tsconfig.build.json index c5318e83fe..7fc770fac7 100644 --- a/tsconfig.build.json +++ b/tsconfig.build.json @@ -51,7 +51,7 @@ { "path": "./packages/support/subagent-mock" }, { "path": "./packages/subagent/tool-subagent" }, { "path": "./packages/subagent/subagent-inprocess" }, - { "path": "./packages/subagent/subagent-process" }, + { "path": "./packages/subagent/subagent-subprocess" }, { "path": "./packages/subagent/subagent-spawn" }, { "path": "./packages/subagent/subagent-fork" }, { "path": "./packages/subagent/subagent-acp" }, diff --git a/tsconfig.json b/tsconfig.json index 8882714d50..380d5f72f5 100644 --- a/tsconfig.json +++ b/tsconfig.json @@ -62,7 +62,7 @@ { "path": "./packages/support/subagent-mock" }, { "path": "./packages/subagent/tool-subagent" }, { "path": "./packages/subagent/subagent-inprocess" }, - { "path": "./packages/subagent/subagent-process" }, + { "path": "./packages/subagent/subagent-subprocess" }, { "path": "./packages/subagent/subagent-spawn" }, { "path": "./packages/subagent/subagent-fork" }, { "path": "./packages/subagent/subagent-acp" }, From 0ba6d832f80049a6f7c7c89092619296b915b0ac Mon Sep 17 00:00:00 2001 From: pku-xht Date: Thu, 9 Jul 2026 14:19:36 +0800 Subject: [PATCH 6/8] docs: regenerate the module graph on the merged tree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The master merge (5309ea54) resolved the module-graph conflict by hand, placing the subagent-subprocess dependency-table row ahead of util/timeout's; the generator's deterministic order (group order, util first) wants them swapped, so the freshness gate (gen-module-graph --check) failed CI's static job. Regenerated on the merged tree — a two-line swap; every other generated catalog was already resolution-fresh (regen-all changed nothing else). --- docs/module-graph.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/module-graph.md b/docs/module-graph.md index 3cb0d6c386..2b606d38db 100644 --- a/docs/module-graph.md +++ b/docs/module-graph.md @@ -229,8 +229,8 @@ flowchart TD | Package | Group | Depends on | | --- | --- | --- | | [`brand`](../packages/util/brand) | `util` | — | -| [`subagent-subprocess`](../packages/subagent/subagent-subprocess) | `subagent` | — | | [`timeout`](../packages/util/timeout) | `util` | — | +| [`subagent-subprocess`](../packages/subagent/subagent-subprocess) | `subagent` | — | | [`acp-snapshot`](../packages/support/acp-snapshot) | `support` | — | | [`app-boot`](../packages/ui/app-boot) | `ui` | — | | [`code-runtime`](../packages/code-runtime/code-runtime) | `code-runtime` | — | From 64b4e2ed2db6d5a27c1266b5c8bd97c8532929b1 Mon Sep 17 00:00:00 2001 From: pku-xht Date: Fri, 10 Jul 2026 16:43:41 +0800 Subject: [PATCH 7/8] test(workflow-workerthread): flake-proof the lifecycle spec's waits under CI load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The spec's 16 vi.waitFor sites used the 1s default timeout to wait for worker-thread startup and child registration — CPU-bound work that blows past 1s on a contended runner. The CI coverage lane (4 vitest workers plus suites that spawn real subprocesses) hit this 3 times across 4 recent PR runs, each a different subset of the cancellation/worker-death tests, each green on rerun. Every wait now goes through a shared helper with a 10s bound, and the file sets a 30s test timeout to make room for it. The one deliberately tight wait keeps its 800ms bound through the helper's override — it proves the host (not the wedged worker's later loop turn) delivered the cancel, so a generous bound would erase what it tests. No behavior under test changed. --- .../tests/workflow-workerthread.spec.ts | 52 +++++++++++++------ 1 file changed, 36 insertions(+), 16 deletions(-) diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index ecaeed61f6..175a82a7b9 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -15,6 +15,26 @@ function fakeParent(): Agent { return { id: AgentId('workflow-parent'), options: {} } as unknown as Agent } +// Worker-thread startup is CPU-bound (a fresh thread compiles the runtime on +// every start): on a contended CI runner it regularly blows past vitest's 5s +// default test timeout, observed repeatedly on the coverage lane. +vi.setConfig({ testTimeout: 30_000 }) + +/** + * `vi.waitFor` with a contention-proof timeout: the 1s default flaked + * repeatedly on the CI coverage lane, where worker-thread cold start competes + * with three sibling vitest workers for CPU. Every wait in this file is for + * something that WILL happen (a worker starting, a child registering) — a + * generous bound only removes the flake, it cannot mask a genuine hang (the + * file-wide test timeout above still fences those). + * @param assertion - retried until it stops throwing or the timeout elapses. + * @param timeout - override for a wait that must stay deliberately tight. + * @returns resolves when the assertion passes. + */ +function waitFor(assertion: () => void, timeout = 10_000): Promise { + return vi.waitFor(assertion, { timeout, interval: 50 }) +} + /** The vm-context escape hatch, spelled once: real Worker tests use it to make the WORKER misbehave. */ const ESCAPE = "globalThis.constructor.constructor('return process')()" @@ -316,7 +336,7 @@ describe('dsh-workflow-workerthread', () => { const runEnds: WorkflowResultInfo[] = [] ctx.on('workflow/end', (_info, result) => { runEnds.push(result) }) const handle = ctx.workflows.start({ ...scripted("return await agent('long job')"), parent }) - await vi.waitFor(() => { expect(provider.runs.length).toBe(1) }) + await waitFor(() => { expect(provider.runs.length).toBe(1) }) handle.cancel('user stopped it') const result = await handle.result expect(result.stopReason).toBe('cancelled') @@ -357,7 +377,7 @@ describe('dsh-workflow-workerthread', () => { const controller = new AbortController() const second = ctx.workflows.start({ ...scripted("return await agent('job')"), parent, signal: controller.signal }) - await vi.waitFor(() => { expect(provider.runs.length).toBe(1) }) + await waitFor(() => { expect(provider.runs.length).toBe(1) }) controller.abort() expect((await second.result).stopReason).toBe('cancelled') await second.dispose() @@ -400,7 +420,7 @@ describe('dsh-workflow-workerthread', () => { `), parent, }) - await vi.waitFor(() => { expect(narration).toContain('started') }) + await waitFor(() => { expect(narration).toContain('started') }) handle.cancel('raced the completion') const result = await handle.result expect(result.stopReason).toBe('cancelled') @@ -480,7 +500,7 @@ describe('dsh-workflow-workerthread', () => { }) const result = await handle.result expect(result.stopReason).toBe('completed') - await vi.waitFor(() => { expect(provider.runs.length).toBe(1) }) + await waitFor(() => { expect(provider.runs.length).toBe(1) }) await handle.dispose() // Not a waitFor: by the time dispose() returns, the slow child disposal // must already be complete (host-side registry quiescence). @@ -526,7 +546,7 @@ describe('dsh-workflow-workerthread', () => { expect(result.stopReason).toBe('completed') // BEFORE dispose(): the settlement itself must have aborted the signal — // without it this child would stay live until dispose's terminate. - await vi.waitFor(() => { expect(aborted).toEqual(['workflow settled']) }) + await waitFor(() => { expect(aborted).toEqual(['workflow settled']) }) await handle.dispose() }) @@ -572,9 +592,9 @@ describe('dsh-workflow-workerthread', () => { `), parent: fakeParent(), }) - await vi.waitFor(() => { expect(starts).toBe(1) }) + await waitFor(() => { expect(starts).toBe(1) }) handle.cancel('stop now') - await vi.waitFor(() => { expect(cancelled).toEqual(['stop now']) }, { timeout: 800 }) + await waitFor(() => { expect(cancelled).toEqual(['stop now']) }, 800) // The wedged worker's own completion loses to the in-flight cancel. const result = await handle.result expect(result.stopReason).toBe('cancelled') @@ -602,7 +622,7 @@ describe('dsh-workflow-workerthread', () => { `), parent, }) - await vi.waitFor(() => { expect(provider.runs.length).toBe(1) }) + await waitFor(() => { expect(provider.runs.length).toBe(1) }) const before = Date.now() await handle.dispose() // Bounded by the grace (plus the terminate), never by the 1.5s spin. @@ -625,7 +645,7 @@ describe('dsh-workflow-workerthread', () => { `), parent, }) - await vi.waitFor(() => { expect(provider.runs.length).toBe(1) }) + await waitFor(() => { expect(provider.runs.length).toBe(1) }) const handleDispose = handle.dispose() const result = await handle.result // The script itself settled (the wrapper's own dispose RPC found the @@ -663,7 +683,7 @@ describe('dsh-workflow-workerthread', () => { `), parent, }) - await vi.waitFor(() => { expect(order.filter(entry => entry.startsWith('start:')).length).toBe(2) }) + await waitFor(() => { expect(order.filter(entry => entry.startsWith('start:')).length).toBe(2) }) const fast = provider.runs.find(run => (run.request.prompt[0] as { text?: string }).text === 'fast')! fast.settle(text('fast done')) handle.cancel('stop now') @@ -694,7 +714,7 @@ describe('dsh-workflow-workerthread', () => { ...scripted("await parallel([() => agent('a'), () => agent('b')])\nreturn 'unreachable'"), parent, }) - await vi.waitFor(() => { expect(provider.runs.length).toBe(2) }) + await waitFor(() => { expect(provider.runs.length).toBe(2) }) handle.cancel('user stop') const result = await handle.result expect(result.stopReason).toBe('cancelled') @@ -749,7 +769,7 @@ describe('dsh-workflow-workerthread', () => { // A worker death is a stop reason like any other: workflow/end fires // with the error outcome — for a bus observer it is the only obituary. expect(runEnds).toEqual([{ stopReason: 'error', error: result.error, agentsStarted: 1 }]) - await vi.waitFor(() => { expect(cancelled.length).toBe(1) }) + await waitFor(() => { expect(cancelled.length).toBe(1) }) await handle.dispose() }, 15_000) @@ -770,7 +790,7 @@ describe('dsh-workflow-workerthread', () => { expect(result.stopReason).toBe('error') expect(result.error).toContain('worker blew up') // The reap wound the stray child down (cancel + a CLEAN dispose). - await vi.waitFor(() => { + await waitFor(() => { expect(provider.runs.length).toBe(1) expect(provider.runs[0]!.disposed).toBe(true) }) @@ -802,7 +822,7 @@ describe('dsh-workflow-workerthread', () => { `), parent, }) - await vi.waitFor(() => { expect(order.filter(entry => entry.startsWith('start:')).length).toBe(2) }) + await waitFor(() => { expect(order.filter(entry => entry.startsWith('start:')).length).toBe(2) }) const fast = provider.runs.find(run => (run.request.prompt[0] as { text?: string }).text === 'fast')! fast.settle(text('fast done')) const result = await handle.result @@ -837,7 +857,7 @@ describe('dsh-workflow-workerthread', () => { const result = await handle.result expect(result.stopReason).toBe('error') expect(result.error).toContain('exit code 5') - await vi.waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }) + await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }) await handle.dispose() }, 15_000) @@ -855,7 +875,7 @@ describe('dsh-workflow-workerthread', () => { }) const logs: string[] = [] ctx.on('workflow/log', (_info, message) => { logs.push(message) }) - await vi.waitFor(() => { expect(logs).toContain('armed') }) + await waitFor(() => { expect(logs).toContain('armed') }) handle.cancel('stop it') // The grace is deliberately huge: only the worker's own death (exit 3, // unreachable by the cancel — the script ignores hooks) settles this. From dd2f37b80fa1e69403268f02bd64b4576daa01f8 Mon Sep 17 00:00:00 2001 From: pku-xht Date: Fri, 10 Jul 2026 20:48:14 +0800 Subject: [PATCH 8/8] fix(workflow-workerthread): tighten post-result promptness waits back down MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review follow-up: the blanket 10s default correctly targets worker-thread cold-start races (starting, first-script-line, async child-registration messages — genuinely CPU-bound under CI contention), but four waits assert something different — that the HOST reacted PROMPTLY to an event that already happened (a settled result, an observed worker death). Those had no cold-start left to wait on, so the generous default just widened the window a real regression could hide in. Verified by injecting a 6s delay into the settle-reap's abort call: the un-overridden helper's test still passed in ~6s. The same mutation now fails in ~1s with the explicit 1000ms override restored on all four sites (the abort-on-settle test's own assertion, the two worker-death cancel/dispose reap checks, and the dispose-ack-race check). The other 12 waits keep the 10s default — they run BEFORE a result is awaited, waiting on the worker to actually start rather than on a host reaction. Doc comment corrected to describe the split instead of claiming every wait is a cold-start race. --- .../tests/workflow-workerthread.spec.ts | 38 +++++++++++++------ 1 file changed, 27 insertions(+), 11 deletions(-) diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index 175a82a7b9..75a0b5116e 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -21,12 +21,18 @@ function fakeParent(): Agent { vi.setConfig({ testTimeout: 30_000 }) /** - * `vi.waitFor` with a contention-proof timeout: the 1s default flaked - * repeatedly on the CI coverage lane, where worker-thread cold start competes - * with three sibling vitest workers for CPU. Every wait in this file is for - * something that WILL happen (a worker starting, a child registering) — a - * generous bound only removes the flake, it cannot mask a genuine hang (the - * file-wide test timeout above still fences those). + * `vi.waitFor` with a contention-proof default timeout: the 1s default + * flaked repeatedly on the CI coverage lane, where worker-thread cold start + * (CPU-bound — a fresh thread compiles the runtime) competes with three + * sibling vitest workers for CPU. The 10s default is for exactly those + * races — waiting for a worker to start, run its first script line, or + * deliver an async child-registration message to the host. It is NOT for a + * wait that asserts the HOST reacted PROMPTLY to something that already + * happened (a settled result, an observed worker death): those keep an + * explicit tight override below, or the generous default would silently + * accept a multi-second regression in host-side reap latency as passing + * (proven by injecting a 6s delay into one such reap and watching the + * un-overridden version of this helper still pass in ~6s). * @param assertion - retried until it stops throwing or the timeout elapses. * @param timeout - override for a wait that must stay deliberately tight. * @returns resolves when the assertion passes. @@ -545,8 +551,11 @@ describe('dsh-workflow-workerthread', () => { const result = await handle.result expect(result.stopReason).toBe('completed') // BEFORE dispose(): the settlement itself must have aborted the signal — - // without it this child would stay live until dispose's terminate. - await waitFor(() => { expect(aborted).toEqual(['workflow settled']) }) + // without it this child would stay live until dispose's terminate. This + // is a HOST-PROMPTNESS claim, not a cold-start race — a tight explicit + // bound (unlike the file default) so a multi-second reap regression + // cannot pass by outlasting the wait. + await waitFor(() => { expect(aborted).toEqual(['workflow settled']) }, 1000) await handle.dispose() }) @@ -769,7 +778,9 @@ describe('dsh-workflow-workerthread', () => { // A worker death is a stop reason like any other: workflow/end fires // with the error outcome — for a bus observer it is the only obituary. expect(runEnds).toEqual([{ stopReason: 'error', error: result.error, agentsStarted: 1 }]) - await waitFor(() => { expect(cancelled.length).toBe(1) }) + // Result already settled — this is the reap's promptness, not a + // cold-start race; tight explicit bound (see the helper's doc comment). + await waitFor(() => { expect(cancelled.length).toBe(1) }, 1000) await handle.dispose() }, 15_000) @@ -790,10 +801,12 @@ describe('dsh-workflow-workerthread', () => { expect(result.stopReason).toBe('error') expect(result.error).toContain('worker blew up') // The reap wound the stray child down (cancel + a CLEAN dispose). + // Result already settled — this is the reap's promptness, not a + // cold-start race; tight explicit bound (see the helper's doc comment). await waitFor(() => { expect(provider.runs.length).toBe(1) expect(provider.runs[0]!.disposed).toBe(true) - }) + }, 1000) await handle.dispose() }, 15_000) @@ -857,7 +870,10 @@ describe('dsh-workflow-workerthread', () => { const result = await handle.result expect(result.stopReason).toBe('error') expect(result.error).toContain('exit code 5') - await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }) + // Result already settled — this is the reap's promptness (bounded + // above the mock's fixed 300ms dispose delay, not a cold-start race); + // tight explicit bound (see the helper's doc comment). + await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }, 1000) await handle.dispose() }, 15_000)